ASP.NET File upload - Validation

Question

In our application , we are using asp.net FileUpload control to upload files.

Requirement is , user should be able to upload only ".doc, .xls , .pdf" files.

System should not allow him to upload other files. To achieve this we are validating the extension of the uploaded file. If it is not valid then throwing error message.. this works fine..

But if i change the any exe file as .doc file , then system is allowing to upload. this should not happen.

Is there any way to validate the file with its content instead of its extension ..?

Answer 1

Check out this question/answer on stackoverflow. I belive this is a duplicate question.

Also, look into reading a file's magic number especially if you are just trying to determine if the file is one of a few acceptable types. Magic number Wikipedia

Answer 2

You can check MIME content type of the uploaded file

bool isExe = (fileUpload.PostedFile.ContentType == "application/octet-stream") 
    || (fileUpload.PostedFile.ContentType == "application/zip");

But I'm not sure if it is easy to fake or not.

Answer 3

Uploadify is a good file uploading tool that I have found which allows you to specify which extensions you allow the user to see when uploading their files. It also has alot of other cool options and it is highly customizeable. It uses a combination of jquery and flash to allow the user to upload more than one file at a time as well (if desired).